Services Australia

It has improved notifications for participants, improved provider guidance and introduced the introduction of improved provider training.

The development of clear and consistent complaints and review process information alongside Services Australia have also been introduced, along with greater mandatory annual training for all staff which covers decision-making under legislation, the exercise of discretion and good practices around making decisions that are valid and lawful.

The Secretary has provided the government with assurances that decision-making under the elements of the targeted compliance framework that resumed this week are operating in accordance with the law.

The Secretary has informed me that IT systems will continue to be tested to ensure any payment cancellations and notifications are operating lawfully and regular meetings will occur with Services Australia and the Department of Social Services to support ongoing assurance activities.

The secretary has established a dedicated assurance function within the department to provide ongoing oversight of system integrity.

I can assure the member that our government takes these issues very seriously And it is my expectation that this work will continue to be undertaken as a matter of priority to ensure that all systems are operating as intended.

And the invoice doesn't come in the mail.

It comes as a debt letter from Services Australia 18 months later, comes as a super decision you made by default and that you can't unmake, and also comes as a lump sum that sat in a savings account for three years while you waited to feel ready for advice.

Today, I'm going to put real numbers on the bill that nobody sends you.

This is Military Money.

And this is how every income tested system works.

Family tax benefit.

If you've got kids, this is paid during the year of an income estimate you give Services Australia.

Then after tax time, they reconcile this.

If you do it wrong, then there's already self-regulation you Now, about a few months ago, OpenAI was sending their web scrapers out to gather information on the stats in Australia's health system.

Now, it found a website from Services Australia.

And that website had, let's say, 50 pages on there.

It's great, the information.

There is 70.

It's just the others aren't indexed.

So this is a public-facing Services Australia, Australian Medicare Statistics website.

So they're not listed.

Today, an AI agent, a government health portal, and apparently a very flexible interpretation of the word no.

Recently, Australian Prime Minister Anthony Albanese said an open AI agent accessed the Medicare Statistics Reporting Portal run by Services Australia.

It went through public and non-public files, and the government didn't notice for three months.

Adrienne, why should everyone be paying attention?

OpenAI found it on the 11th of August during an internal review of model behaviour.

On the 1st of September, Sam Altman met with Richard Marles, who is Deputy Prime Minister and Defence Minister, and the breach didn't come up in their conversation, astoundingly.

On the 10th of September, OpenAI emailed the Services Australia public disclosures inboxed

Wait, the public disclosures inbox, that same kind of inbox where complaints about behold music go to die?

But the Guardian reports that a source with knowledge of the incident said humans reviewed the final email and humans were responsible for actually sending the communication to the service's Australia inbox.

Now, I think where the problem comes is that the AI, yeah, it wrote the email, but the first email sent to notify the government was to this Services Australia inbox that I just alluded to, which is publicdisclosuresatservicesaustralia.gov.au, which was just like a generic mailbox that employees only checked once per day.

open ai have subsequently admitted that they could have handled the communication better but have not yet confirmed that ai was used for writing the notice i think it would be one thing if it's ai writing the notice and another thing if it's also ai figuring out what email address to use to contact the australian government to tell them that their websites have been breached that would be a little more problematic it would just it would basically be that you know open ais are running on autopilot and they don't really take care when they hit government targets, whether purposely or inadvertently, which I assume it's inadvertent.

At least that's the way it was reported, but not good.

And OpenAI says that its models took actions that they had not intended.

In other words, OpenAI is saying, "We didn't mean to break into the Australian government, but here we are." Now, ABC Australia is reporting that essentially OpenAI discovered the breach in August, but they only notified Services Australia on September 10th.

And so that gap actually raises a question in my mind.

How quickly must companies warn people and governments affected when their systems cross this type of boundary? So let's talk about why this is actually going to get harder and harder and harder in the age of AI because my concern here is the scale of this.

Developers and operators need clear responsibilities when preventable failures can cause harm.

And governments must also secure their own systems.

This definitely takes two to tango here, and apparently Services Australia's medical, uh, portal was insecure.

But the requirements should also match the danger, and that's something that a lot of people miss.

It's funny how you talk about that tunnel, 'cause I use the tunnel analogy a lot.

The, the emergence from domestic violence can be a very long and winding tunnel, and depending on the situation, it could incor- include authorities like the courts or the police, um, Centrelink, Child Support.

A range of different things can happen lo- along the way, and sometimes we don't know how long that tunnel's going to, to last, and there can be different things that are thrown into that tunnel.

So I think it's really important that those people that feel that they can come forward and share their story of hope, they're those little lanterns that light the way when somebody is walking along that tunnel, um, to show that there is gonna be light at the end of it and that there is support available.

Yes.

The source material strongly advises anyone affected to be on high alert for targeted scams, to contact Services Australia regarding Medicare concerns, and to lean on ID Care, the National Identity Support Service.

But honestly, the permanence of this leak just seems like an unfixable problem for the victims.

It is.